Skip to main content

EventBot Trojan

EventBot is a newly observed trojan primarily targeting European banking, financial, and cryptocurrency applications.

Threat ID:
CC-3447
Category:
Trojan
Threat Severity:
Low
Threat Vector:
Download
Published:
6 May 2020 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

EventBot is a newly observed trojan primarily targeting European banking, financial, and cryptocurrency applications.

Affected platforms

The following platforms are known to be affected:

Android

  • Google Android - All versions

Threat details

At the time of publication, it is unclear how EventBot is delivered, although there are unconfirmed reports indicating it may be distributed through the Google Play Store disguised as utility applications.

When installed, EventBot will ask for full administration privileges before removing itself from the affected device's application launcher. It then uses Android's Accessibility features to collect system and user information, including location and installed application lists, before sending it to a command and control (C2) server. It will then monitor the user's web browser, SMS, and application inputs in order to extract credentials, as well as attempt to phish sensitive information from webpages the user visits. Any extracted credentials or information is then encrypted and sent to the C2 server

Remediation steps

Type Step

To prevent and detect a trojan infection, NHS Digital advises that:

  • Secure configurations are applied to all devices.
  • Security updates are applied at the earliest opportunity.
  • Tamper protection settings in security products are enabled where available.
  • Obsolete platforms are segregated from the rest of the network.
  • IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
  • Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
  • Administrative accounts are only used for necessary purposes.
  • Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
  • Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.

Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.

Indicators of compromise

Main indicators

Last edited: 29 June 2021 12:01 pm